Ostium Protocol — Oracle Signer Key Compromise (July 2026)

2024-01-01

Ostium Protocol launched its mainnet OLP vault on Arbitrum. Exact launch date within 2024 not confirmed; year sourced from reporting.

2025-11-01

Zellic completed a second security engagement for Ostium, covering upgraded trading contracts ahead of the Jump Liquidity Upgrade. Section 4.8 of the report explicitly flagged risks arising from a compromised forwarder, warning the enumerated concerns were not exhaustive.

2025-12-03

Ostium announced a $20 million Series A co-led by General Catalyst and Jump Crypto, bringing total funding to approximately $27.8 million.

2026-01-01

Ostium's final pre-exploit smart-contract audit was completed. Exact date within January 2026 not confirmed in sourced reporting.

2026-02-14

The oracle signer address (0x38110430184c22d93c30b3e67b9af98d5d0ab8bd) that was later used in the exploit was legitimately registered in Ostium's verifier contract — 151 days before the exploit.

2026-07-15

Attack window opened at 14:18 UTC. An initial test transaction using $100 USDC yielded an $897.80 payout. Twenty-five seconds later, the main drain transaction (0x359f8c05b86a4409d60cfba02084334313fd94b19f74a294fb7fc4ea7d4870e0) extracted $11,862,444 USDC in a single atomic batch. Six additional drain transactions followed. Total drain: 23,752,746 USDC. Attack window closed at 14:23 UTC.

2026-07-15

Blockaid detected the exploit in progress and published a public alert attributing it to a registered PriceUpKeep forwarder and future-dated oracle reports. Ostium paused all trading contracts within approximately sixty minutes of the first exploit transaction.

2026-07-15

Attacker converted stolen USDC to approximately 12,084 ETH via KyberSwap at an average price of approximately $1,966 per ETH and deposited 10,540 ETH into Tornado Cash before the end of the day.

2026-07-15

Kaledora, Ostium co-founder, published a public statement acknowledging the breach, confirming the 14:18–14:23 UTC attack window, and stating the team had identified the issue within minutes.

2026-07-18

Ostium published an update characterizing the incident as stemming from a compromise of 'off-chain infrastructure related to the system that feeds prices into the protocol,' ruling out smart-contract vulnerabilities or multisig compromise.

2026-07-23

Ostium resumed trading following migration to a new production environment with multi-party approvals, enhanced off-chain security controls, and deauthorization of affected systems.

2026-07-30

Ostium published a full post-mortem confirming the $23,752,746 USDC loss and attributing it unambiguously to the compromised off-chain oracle signer. Compensation plan for LPs was described as forthcoming but details not disclosed.